76160 - crash on tooltip callback

Status: VERIFIED INVALID

(Core :: XUL, defect)

Description

[Alan Shields]

HashTableLookup is crashing repeatedly on lookup. I've tried reproducing 
it, but haven't been able to. However, it happens VERY regularly.

I've looked at MacsBug logs, and the last thing on the return stack is 
HashTableLookup. Looking at the code being called by 
HashTableLookup, I'd make a pretty safe bet on the problem lying in 
HashTableGetKey 
(http://lxr.mozilla.org/mozilla/source/rdf/opendir/hash.c#45).

I believe the problem could be related to the fact that GetKey does no 
checking on the parameters given. No null pointer check, etc. If we put this 
in, I think we'll get some better error messages than "unmapped 
memory".

I've attached a StdLog from Macsbug. I'll attach another one for 
comparison when Mozilla crashes again (yes, it's that predictable).

Comment 1

[Alan Shields]

Attachment: StdLog-1

Comment 2

[Chris Waterson]

Not sure why component == RDF? Looks like XUL popup stuff based on the stack trace.

Comment 3

[John Morrison]

Actually, you were looking at the possible return addresses on the stack. 
The more relevant thing in this case is the actual backtrace: 

Calling chain using A6/R1 links
Back chain  ISA  Caller
00000000 PPC 3F5076D0  
0A8F6690 PPC 3F4F2FA0 main+00130
0A8F6630 PPC 3F4F217C main1(int, char**, nsISupports*)+009F8
0A8F6320 PPC 3E971CE8 nsAppShellService::Run()+00018
0A8F62E0 PPC 3E7A7260 nsAppShell::Run()+00048
0A8F6290 PPC 3E7A79AC nsMacMessagePump::DoMessagePump()+0003C
0A8F6240 PPC 3E7A7FBC nsMacMessagePump::DispatchEvent(int, EventRecord*)+0014
0A8F61F0 PPC 3E7BBDA4 Repeater::DoIdlers(const EventRecord&)+00030
0A8F61B0 PPC 3E7BC1E4 nsTimerPeriodical::IdleAction(const EventRecord&)+00014
0A8F6170 PPC 3E7BC58C nsTimerPeriodical::FireNextReadyTimer()+0003C
0A8F6130 PPC 3E7BC3A8 nsTimerPeriodical::FireAndReprimeTimer(nsTimerImpl*)+00
0A8F60E0 PPC 3E7BD0A0 nsTimerImpl::Fire()+00024
0A8F60A0 PPC 3E2E2BE4 XULPopupListenerImpl::sTooltipCallback(nsITimer*, 
void*)+000EC
0A8F5F10 PPC 3E2E2850 XULPopupListenerImpl::LaunchPopup(int, int)+00A10
0A8F5880 PPC 3DD5BC4C 
CreatePopup__19nsPopupSetBoxObjectFP13nsIDOMElementP13nsIDOMElementiiPCwPCwPCw+
00084


Can you detail how this happens. You note that 'you can't reproduce' but it 
happens 'regularly'. Is there some specific action (perhaps related to showing
a tooltip) that you are doing when this occurs?

Comment 4

[Peter Trudelle]

->pinkerton

Comment 5

[Alan Shields]

Okay, I feel like a complete moron now. Of course, Moz crashes with this exact error for a week, then stops. Maybe some website I was going to changed their code. I have no clue. I haven't changed my surfing patterns significantly.

I can't reproduce this at all, so I'm going to go ahead and close it out so it doesn't waste any more time. Gaaah. If it recurrs, I'll finesse it a bit, THEN reopen the bug.

Thanks for your time, guys.

Comment 6

[John Morrison]

Sounds good. If you can figure out how to make this happen, then do reopen
this bug. Thanks.